General Overview

Functional Area: Information Technology (ITM)
Career Stream: IT Risk & Compliance (RAC)
Role: Manager (MG2)
Job Title: Manager, IT Risk & Compliance 2
Job Code: MG2-ITM-RISK
Job Level: Level 10
Direct/Indirect Indicator: Indirect

Summary

The Manager, IT Risk and Compliance participates in IT Security initiatives and projects. They work closely with stakeholders to understand the business (security initiatives and compliance) security requirements and risks and work with IT team to implement. The incumbent is responsible to ensure IT projects/initiatives are part of the Security strategy and within the IT roadmap.

Detailed Description

Performs tasks such as, but not limited to, the following:

• Leads the engagements with stakeholders and IT Security initiatives and projects (including security governance and compliance) ensuring interactive collaboration with the stakeholders IT Security team

• Ensures IT projects/initiatives follow ITPMO process and leads the execution when required, working with project stakeholders to determine acceptable levels of risk for the organization. Maintains contact and communication with all project team members to ensure conformance with requirements and client user expectations. Liaises with enterprise architecture team to ensure project alignment with security architecture

• Participate in compliance projects around IT and National Institute of Standards and Technology (NIST) 800-171

• Responds to various IT audits when required around IT Security projects and compliance initiatives with the whether external or internal

• Provides consultancy and guidance in all aspects of governance which involves evaluating general and specific training needs; delivering training to support the control environment and associated control framework; communicating objectives and fostering a compliance and risk aware culture

• Oversee the deployment and maintenance of IT Security solutions and compliance

• Establish and maintain effective relationships with process owners to proactively assess security risks

Knowledge/Skills/Competencies

• Knowledge of Celestica’s technology, business and IT strategies

• The ability to communicate security and risk-related concepts to technical and nontechnical audiences.

• Organized and able to meet deadlines

• IT Security Best Practices

• IT Governance and Audit Procedures

• Knowledge of common information security frameworks and IT controls frameworks, such as ISO/IEC 27001, ITIL, COBIT and ones from NIST.

• Knowledge and understanding of relevant legal and regulatory requirements, such as Sarbanes-Oxley Act (SOX), Health Insurance Portability and Accountability Act (HIPAA) and Payment Card Industry/Data Security Standard. Knowledge of global requirements.

• Proficient in IT Security

• Advanced knowledge of risk mitigation and business controls

• Advanced knowledge of data management and analytics

• Advanced knowledge of delivering initiatives within the Operating Model

• Advanced knowledge of project management

• Proficient in architecture and solution integration

• Advanced knowledge in business partnering

• IT Penetration Testing

• Mastery in IT Risk Management

• Mastery in IT SoX Compliance

• IT Security Architecture

• Knowledge of IT Compliance Standards and best practices

• Excellent communication and business writing skills with experience in defining business requirements

• Excellent problem resolution and creative problem solving skills

• Strong knowledge of change management process.

• Excellent project management skills

• Ability to apply judgement in selecting and interpreting information, working within authorized limits prescribed by team leader/manager

• Strong customer management skills; ability to clearly articulate the role that IT can play in enhancing customer activities

Physical Demands

• Duties of this position are performed in a normal office environment.

• Duties may require extended periods of sitting and sustained visual concentration on a computer monitor or on numbers and other detailed data. Repetitive manual movements (e.g., data entry, using a computer mouse, using a calculator, etc.) are frequently required.

Typical Experience

• 7 to 10 years of relevant experience.

Typical Education

• Bachelor's Degree or consideration of an equivalent combination of education and experience: IT Risk Management, NIST 800-171 Standard training, CMMC training.

• Educational requirements may vary by geography.

Notes

This job description is not intended to be an exhaustive list of all duties and responsibilities of the position. Employees are held accountable for all duties of the job. Job duties and the % of time identified for any function are subject to change at any time.